skills.rest
Elric412
Elric412COMMUNITY
Explore all skills by this author →
GitHub

security-patterns

Implement secure authentication, authorization, encryption, and secrets management for web and mobile backends.

Updated Aug 27, 2026
Search Tags:#authorization#security#authentication#oauth#jwt#rate-limiting#secrets-management
One-click install
npx skills add https://github.com/Elric412/Leica-cam --skill security-patterns-elric412
Or copy as Structured Prompt for Agent▼
Please help me install this Agent Skill.
Skill: security-patterns
Source: https://github.com/Elric412/Leica-cam/tree/main/.agents/skills/security-patterns
Command: npx skills add https://github.com/Elric412/Leica-cam --skill security-patterns-elric412

SYSTEM DOCUMENTATION & REQUIREMENTS

What problem does it solve?

Prevents insecure authentication, authorization, secret handling, and transport/storage misconfigurations that lead to credential theft, privilege escalation, and data exposure for web and mobile services.

Core Features & Use Cases

  • Authentication patterns: guidance for JWT, session-based auth, OAuth2/OIDC flows, refresh token handling, and secure cookie practices.
  • Authorization models: RBAC and resource-level ownership checks to prevent horizontal privilege escalation.
  • Secrets & encryption: best practices for environment-backed secrets, rotation strategies, encryption at rest and in transit, and vault integration.
  • Operational controls: CORS configuration, rate limiting, security headers (CSP/HSTS), input validation, and anti-pattern avoidance.
  • Use Case: Harden a login and API stack by switching from insecure token storage to httpOnly refresh cookies, adding per-key rate limits, enforcing TLS and CSP, and integrating secret rotation.

Quick Start

Use the security-patterns skill to review an authentication or API configuration and produce prioritized remediation steps for tokens, secrets, CORS, and rate limiting.

Frequently Asked Questions about security-patterns

High-intent search queries and answers about installing and using this skill.

FAQPage Schema
How do I implement secure JWT and OAuth2 authentication flows for a backend API?▼

Secure JWT and OAuth2 authentication is implemented via token issuance, verification, and refresh token handling. The approach applies OAuth/OIDC integrations and httpOnly refresh cookies to harden login stacks for web and mobile backends.

What is the best way to prevent horizontal privilege escalation in my application?▼

Preventing horizontal privilege escalation requires resource-level ownership checks and Role-Based Access Control. These authorization models restrict user access to permitted roles and resources within the backend API.

How do I configure rate limiting and CORS policies for a web application?▼

Rate limiting and CORS policies are configured using persistent stores and strict security headers. This enforces request limits per API key and prevents unauthorized cross-origin access while hardening the backend API.

Does this security patterns approach work for both web SPAs and mobile apps?▼

Yes, this security patterns approach works for web SPAs, mobile apps, and backend APIs. It applies authentication flows, CORS configuration, input validation, and secrets management across these platforms to prevent data exposure.

How do I manage environment-backed secrets and vault integration for encryption?▼

Environment-backed secrets and vault integration are managed using rotation strategies and encryption at rest and in transit. This enforces TLS and ensures secrets are securely stored, rotated, and audited without exposure.

Why do I need bcrypt or argon2 password hashing and CSP headers?▼

Bcrypt or argon2 password hashing and CSP headers are needed to prevent credential theft and cross-site scripting. These controls enforce secure transport, content security policies, and audit-ready logging for backend services.

Related Skills

Explore More Software Engineering Skills→
FSGER9326FSGER9326

security-auditor

Identify and remediate security vulnerabilities in codebases and configurations.

Community
Advanced
heyAyushhheyAyushh
3

bash-expert

Write and harden Bash scripts with POSIX compatibility and safe defaults.

Community
Basic
thc1006thc1006

gateway-api

Configure and deploy Kubernetes Gateway API with Envoy Gateway.

Community
Intermediate
DonTiziDonTizi
2

security-audit

Scan codebases for secrets, OWASP risks, and vulnerable dependencies.

Community
Advanced